Cakephp 2.x and Csrf token

1
votes

Im using cakephp 2.x with security component activated, the problem is i disabled csrf verification for my json requests like this :

$this->Security->unlockedActions = array('do_json');

Is it possible to remove the unlockedActions code from the beforefilter and integrate csrf verification in json requests as well like other not json actions.

Thanks in advance.

1
phpjsoncakephp

1 Answers

1
votes

You'll most likely have to disable POST data validation, unless your requests would contain data from forms that have been built with the form helper:

$this->Security->validatePost = false;

And then you have to include the CSRF token in your requests POST data. The generated token can be found in the request parameters as _Token.key:

$this->request->param('_Token.key')
// or
$this->request->params['_Token']['key']

and needs to be submitted as _Token.key too, ie

{
    "_Token": {
        "key": "keyValue"
    }
}

See also